CVE-2026-47214

Docling: Unsafe URI and Path Handling in HTML Backend

State: Published
Severity: 7.1 High
Published: Jun 26, 2026
Updated: Jun 26, 2026
Reserved: May 18, 2026

Description

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. Prior to 2.94.0, the HTML backend has unsafe URI and path handling. This vulnerability is fixed in 2.94.0.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L	GitHub_M

Weaknesses

CWE-73 External Control of File Name or Path
CWE-400 Uncontrolled Resource Consumption

Affected Products

Product	Versions
doclingdocling-project	< 2.94.0Affected

References

https://github.com/docling-project/docling/security/advisories/GHSA-q29v-xc37-wh5m
https://github.com/docling-project/docling/releases/tag/v2.94.0

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.